11.12.4.1. SpamAssassin and Postfix
"Open Source mail filter, written in Perl, to identify spam using a wide range of heuristic tests on mail headers and body text. Free software."
When using Fedora, the spamassassin package provides SpamAssassin. Run rpm -q spamassassin
to see if the spamassassin package is installed. If it is not installed, run the following command as the root user to install it:
yum install spamassassin
SpamAssassin operates in tandom with a mailer such as Postfix to provide spam-filtering capabilities. In order for SpamAssassin to effectively intercept, analyze and filter mail, it must listen on a network interface. The default port for SpamAssassin is TCP/783, however this can be changed. The following example provides a real-world demonstration of how SELinux complements SpamAssassin by only allowing it access to a certain port by default. This example will then demonstrate how to change the port and have SpamAssassin operate on a non-default port.
Note that this is an example only and demonstrates how SELinux can affect a simple configuration of SpamAssassin. Comprehensive documentation of SpamAssassin is beyond the scope of this document. Refer to the official
SpamAssassin documentation for further details. This example assumes the
spamassassin is installed, that any firewall has been configured to allow access on the ports in use, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:
Running SpamAssassin on a non-default port
Run the semanage
command to show the port that SELinux allows spamd
to listen on by default:
# semanage port -l | grep spamd
spamd_port_t tcp 783
This output shows that TCP/783 is defined in spamd_port_t
as the port for SpamAssassin to operate on.
Edit the /etc/sysconfig/spamassassin
configuration file and modify it so that it will start SpamAssassin on the example port TCP/10000:
# Options to spamd
SPAMDOPTIONS="-d -p 10000 -c m5 -H"
This line now specifies that SpamAssassin will operate on port 10000. The rest of this example will show how to modify SELinux policy to allow this socket to be opened.
Start SpamAssassin and an error message similar to the following will appear:
/etc/init.d/spamassassin start
Starting spamd: [2203] warn: server socket setup failed, retry 1: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
[2203] warn: server socket setup failed, retry 2: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
[2203] error: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
[FAILED]
This output means that SELinux has blocked access to this port.
A denial similar to the following will be logged by SELinux:
SELinux is preventing the spamd (spamd_t) from binding to port 10000.
As the root user, run the semanage
command to modify SELinux policy in order to allow SpamAssassin to operate on the example port (TCP/10000):
semanage port -a -t spamd_port_t -p tcp 10000
Confirm that SpamAssassin will now start and is operating on TCP port 10000:
# /etc/init.d/spamassassin start
Starting spamd: [ OK ]
# netstat -lnp | grep 10000
tcp 0 0 127.0.0.1:10000 0.0.0.0:* LISTEN 2224/spamd.pid
At this point, spamd
is properly operating on TCP port 10000 as it has been allowed access to that port by SELinux policy.